From 13b74ba8a73fd6edc39835d0b06a89d8c44ba160 Mon Sep 17 00:00:00 2001
From: FrameBridge <gerardobh1128@gmail.com>
Date: Wed, 28 Oct 2026 14:06:48 -0400
Subject: [PATCH] Redirect only the public HTTP ingress to canonical HTTPS

---
 deployment/geranas/nginx.conf.in | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/deployment/geranas/nginx.conf.in b/deployment/geranas/nginx.conf.in
index 9ad4f60..55960c7 100644
--- a/deployment/geranas/nginx.conf.in
+++ b/deployment/geranas/nginx.conf.in
@@ -16,6 +16,10 @@ http {
     uwsgi_temp_path /run/framebridge-publisher/uwsgi;
     scgi_temp_path /run/framebridge-publisher/scgi;
     map $http_upgrade $connection_upgrade { default upgrade; '' close; }
+    map "$host|$http_x_forwarded_proto" $framebridge_https_redirect {
+        default 0;
+        "framebridge.betancourt.one|http" 1;
+    }
     server {
         listen 127.0.0.1:8088;
         listen @GERANAS_LAN_IP@:8088;
@@ -23,6 +27,7 @@ http {
         allow @CLOUD_LAN_IP@;
         deny all;
         server_name framebridge.betancourt.one;
+        if ($framebridge_https_redirect) { return 301 https://framebridge.betancourt.one$request_uri; }
         root /run/framebridge-publisher/site;
         index index.html;
         autoindex off;